Access, when someone leaves

I found it while doing something else entirely, which is how these things are always found. The payroll system had one administrator account, and it belonged to a contractor who had finished his work and left in 2021. He was perfectly decent about it when they got hold of him. That is not the point.

Access in a small company is granted by conversation. Someone needs the billing portal, someone else adds them, and no record exists that the grant ever happened. It works beautifully right up until the morning you need to undo it quickly, and mornings like that are rarely calm.

What you need is not a security policy. It is one page listing every system the company pays for or depends on, who administers it, and how an account gets removed. I have built this page with maybe a dozen companies now. The founders guess twenty systems. It is never fewer than thirty and it once ran to sixty three.

Two habits keep it alive. Add a line whenever the company signs up for anything new, and once a quarter read the page with the bank statement open beside it. Anything you are paying for that is not on the page is either a subscription to cancel or a system with no owner, and both are worth an hour of anybody's attention.

MMB